[Bug 4014] New: ssh-keygen -R and -F miss a hashed known_hosts entry when the host name's case differs

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4014

            Bug ID: 4014
           Summary: ssh-keygen -R and -F miss a hashed known_hosts entry
                    when the host name's case differs
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: critical
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jirenthegray03 at gmail.com

ssh-keygen -R is how an operator removes a host key they no longer
trust. On a hashed known_hosts it reports "not found" and exits 0 while
the entry stays in the file, so a revocation step in a script reports
success and the key remains trusted. Host names are case-insensitive,
and ssh-keygen -H lowercases a name before hashing it, so the case that
fails is the one an operator is most likely to type.

Repro:
```
$ printf 'Host.Example.COM ' > known; cat kh.pub >> known; ssh-keygen
-Hf known
$ cut -c1-30 known
|1|tzT1zPB5JHAjQ3PFHH1zb3Nrzqg=|…         <- -H lowercased the name
before hashing it

$ ssh-keygen -R Host.Example.COM -f known
Host Host.Example.COM not found in known     <- exit 0, the entry is
still there
$ ssh-keygen -R host.example.com -f known
# Host host.example.com found: line 1
known updated.                               <- removed

$ ssh-keygen -F Host.Example.COM -f known    <- no output
$ ssh-keygen -F host.example.com -f known    <- finds it

```
On an unhashed file, -R Host.Example.COM removes the line, so the
behaviour differs by whether the file is hashed.

Potential causee: Entries are always stored lowercased:
write_host_entry() calls lowercase(lhost) before writing, hashed or not
(hostfile.c:443-444), and ssh-keygen -H lowercases before hashing
(ssh-keygen.c:1202). -F and -R pass the argument through unchanged
(ctx.host = name, ssh-keygen.c:1314), so it is hashed verbatim and a
name with any uppercase letter hashes to something that is not in the
file. An unhashed line is matched by case-insensitive pattern match
instead, which is why only hashed files are affected — and why the
entry ssh itself wrote for Host.Example.COM cannot be removed by that
name.

Potential fix: Lowercase the host name in -F and -R as -H and
write_host_entry() do. Exiting non-zero when -R removed nothing would
also make the failure visible to a script.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.